5 ms·

This is why you are supposed to choose whichever dependency you add to your project very very carefully. Also, each dependency you add to project is a security

This is why you are supposed to choose whichever dependency you add to your project very very carefully. Also, each dependency you add to project is a security risk in itself. I really can’t believe how webdesigners casually add dependencies without a second thought especially with dependency management system like npm. People give C++ lots of hate but thanks to not having an easy way of adding complex dependencies, it has less dependency driven bugs/security issues.

TylerE 6y ago
> People give C++ lots of hate but thanks to not having an easy way of adding complex dependencies, it has less dependency driven bugs/security issues. Oh, come on. The number of security issues to things like libssl alone is enormous.
- pfundstein 6y ago
  Oh come one, you're describing a single dependency which being encryption is generally recommended against rolling your own. Don't try and tell me C++ projects in general have more dependencies than high level languages.
  - rossjudson 6y ago
    Nope, but I'm happy to tell you that C/C++ projects in general have more security flaws than high level languages.
    - pfundstein 6y ago
      Don't shift the goal posts, we're talking specifically about dependencies and dependency driven bugs.
      - dodobirdlord 6y ago
        Languages like C++ that lack memory safety have the irritating property that a memory safety error anywhere in the dependency tree can be exploited to attack unrelated parts of the binary. In most languages you don’t have to worry that some stateless pure-function log formatter is secretly the gap in your armor.
    - gigel82 6y ago
      That's superficial. How many "high level languages" roll their own SSL from scratch? I'd bet most of them link down to the C++ libssl, so of course that one gets a lot of heat, but it also means it's a very robust piece of software.
  - PaulDavisThe1st 6y ago
    I'll try: https://nightly.ardour.org/i/A_Linux_i386/info.txt https://nightly.ardour.org/i/A_Linux_i386/info.txt That's the dependency stack for a 350k LOC cross-platform C++ project. I'll leave it to your judgement if this is more or less than "high level languages".
    - pfundstein 6y ago
      Cherry picking is pointless and doesn't prove anything
      - TylerE 6y ago
        Neither does just invoking No True Scotsman at every turn.
  - rcxdude 6y ago
    They certainly don't have less to a degree which makes up for the lack of tooling to support it. C++ dependency management is a nightmare which dwarfs even the worst of npm. Even if it were to half the number of dependencies it doesn't make up for the 10 times more dependency and build-related issues which appear.
- The_rationalist 6y ago
  Code that you reinvent/maintain yourself is almost always less actively maintained than the dependency you could have used. Less maintained code universally means more buggy code. (not even talking about performance and features) It all boils down to human resources. Also your saved human resources by using a dependency can be reallocated either at bettering the rest of your code or towards contributing to the dependency. Regarding security issues in C++ in general: ~51% of security issues are memory related, so you get at least half less security issues with a garbage collected language.
rcxdude 6y ago
> People give C++ lots of hate but thanks to not having an easy way of adding complex dependencies, it has less dependency driven bugs/security issues. This doesn't stop people adding dependencies: most C++ software still has a complex dependency tree, just most of the labour of maintaining it falls on distro maintainers (and the poor souls which need to make windows builds) [0] And I don't think C++ has any shortage of dependency driven bugs or security issues. Certainly if you asked me to pick whether I'd like to build something from npm or the average C++ project I'd pick npm every time: I expect to need to fix on average about 2 issues every time I attempt to run a non-trivial C++ project's build, each issue taking an hour or so to locate and fix or hack around. The nature of C++ dependency management means there's more likely to be vendored dependencies which are out of date and have security issues, perhaps introduced by the dependee project as patches (and ripping out this kind of vendoring and dealing with any required patches creates even more headaches for distro maintainers, though they are also quite capable of introducing their own bugs through their own patches). [0] https://wiki.alopex.li/LetsBeRealAboutDependencies https://wiki.alopex.li/LetsBeRealAboutDependencies

TylerE 6y ago

> People give C++ lots of hate but thanks to not having an easy way of adding complex dependencies, it has less dependency driven bugs/security issues. Oh, come on. The number of security issues to things like libssl alone is enormous.

pfundstein 6y ago
Oh come one, you're describing a single dependency which being encryption is generally recommended against rolling your own. Don't try and tell me C++ projects in general have more dependencies than high level languages.
- rossjudson 6y ago
  Nope, but I'm happy to tell you that C/C++ projects in general have more security flaws than high level languages.
  - pfundstein 6y ago
    Don't shift the goal posts, we're talking specifically about dependencies and dependency driven bugs.
    - dodobirdlord 6y ago
      Languages like C++ that lack memory safety have the irritating property that a memory safety error anywhere in the dependency tree can be exploited to attack unrelated parts of the binary. In most languages you don’t have to worry that some stateless pure-function log formatter is secretly the gap in your armor.
  - gigel82 6y ago
    That's superficial. How many "high level languages" roll their own SSL from scratch? I'd bet most of them link down to the C++ libssl, so of course that one gets a lot of heat, but it also means it's a very robust piece of software.
- PaulDavisThe1st 6y ago
  I'll try: https://nightly.ardour.org/i/A_Linux_i386/info.txt https://nightly.ardour.org/i/A_Linux_i386/info.txt That's the dependency stack for a 350k LOC cross-platform C++ project. I'll leave it to your judgement if this is more or less than "high level languages".
  - pfundstein 6y ago
    Cherry picking is pointless and doesn't prove anything
    - TylerE 6y ago
      Neither does just invoking No True Scotsman at every turn.
- rcxdude 6y ago
  They certainly don't have less to a degree which makes up for the lack of tooling to support it. C++ dependency management is a nightmare which dwarfs even the worst of npm. Even if it were to half the number of dependencies it doesn't make up for the 10 times more dependency and build-related issues which appear.
The_rationalist 6y ago
Code that you reinvent/maintain yourself is almost always less actively maintained than the dependency you could have used. Less maintained code universally means more buggy code. (not even talking about performance and features) It all boils down to human resources. Also your saved human resources by using a dependency can be reallocated either at bettering the rest of your code or towards contributing to the dependency. Regarding security issues in C++ in general: ~51% of security issues are memory related, so you get at least half less security issues with a garbage collected language.

rcxdude 6y ago

> People give C++ lots of hate but thanks to not having an easy way of adding complex dependencies, it has less dependency driven bugs/security issues. This doesn't stop people adding dependencies: most C++ software still has a complex dependency tree, just most of the labour of maintaining it falls on distro maintainers (and the poor souls which need to make windows builds) [0] And I don't think C++ has any shortage of dependency driven bugs or security issues. Certainly if you asked me to pick whether I'd like to build something from npm or the average C++ project I'd pick npm every time: I expect to need to fix on average about 2 issues every time I attempt to run a non-trivial C++ project's build, each issue taking an hour or so to locate and fix or hack around. The nature of C++ dependency management means there's more likely to be vendored dependencies which are out of date and have security issues, perhaps introduced by the dependee project as patches (and ripping out this kind of vendoring and dealing with any required patches creates even more headaches for distro maintainers, though they are also quite capable of introducing their own bugs through their own patches). [0] https://wiki.alopex.li/LetsBeRealAboutDependencies https://wiki.alopex.li/LetsBeRealAboutDependencies